diff --git a/MODULE.bazel b/MODULE.bazel
index e47c16bd0e0..6e7de38eeb6 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -320,6 +320,13 @@ use_repo(
 # Note that this is 'rules_nodejs-core'
 # Keep in sync with build_bazel_rules_nodejs in WORKSPACE.bzlmod
 bazel_dep(name = "rules_nodejs", version = "5.8.2")
+single_version_override(
+    module_name = "rules_nodejs",
+    patch_strip = 1,
+    patches = [
+        "@@//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
+)
 
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
 node.toolchain(
diff --git a/WORKSPACE b/WORKSPACE
index 4fca188d55a..1a0b94030b0 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -180,10 +180,24 @@ staticcheck()
 
 http_archive(
     name = "build_bazel_rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
     sha256 = "94070eff79305be05b7699207fbac5d2608054dd53e6109f7d00d923919ff45a",
     urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-5.8.2.tar.gz"],
 )
 
+http_archive(
+    name = "rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
+    sha256 = "764a3b3757bb8c3c6a02ba3344731a3d71e558220adcb0cf7e43c9bba2c37ba8",
+    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-core-5.8.2.tar.gz"],
+)
+
 load("@build_bazel_rules_nodejs//:repositories.bzl", "build_bazel_rules_nodejs_dependencies")
 
 build_bazel_rules_nodejs_dependencies()
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
index 02abda61286..59a76c064a0 100644
--- a/WORKSPACE.bzlmod
+++ b/WORKSPACE.bzlmod
@@ -41,6 +41,10 @@ http_archive(
 # Since there is no build_bazel_rules_nodejs in BCR, we still want to load it here.
 http_archive(
     name = "build_bazel_rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
     sha256 = "94070eff79305be05b7699207fbac5d2608054dd53e6109f7d00d923919ff45a",
     urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-5.8.2.tar.gz"],
 )
diff --git a/buildpatches/build_bazel_rules_nodejs.patch b/buildpatches/build_bazel_rules_nodejs.patch
new file mode 100644
index 00000000000..60d9527fbb8
--- /dev/null
+++ b/buildpatches/build_bazel_rules_nodejs.patch
@@ -0,0 +1,19 @@
+--- a/third_party/github.com/bazelbuild/bazel-skylib/rules/private/copy_common_private.bzl
++++ b/third_party/github.com/bazelbuild/bazel-skylib/rules/private/copy_common_private.bzl
+@@ -64,10 +64,10 @@
+     # Sandboxing for this action is wasteful as well since there is a 1:1 mapping of input
+     # file/directory to output file/directory and no room for non-hermetic inputs to sneak in to the
+     # input.
+-    "no-remote": "1",
+-    "no-remote-cache": "1",
+-    "no-remote-exec": "1",
+-    "no-cache": "1",
+-    "no-sandbox": "1",
+-    "local": "1",
++    # "no-remote": "1",
++    # "no-remote-cache": "1",
++    # "no-remote-exec": "1",
++    # "no-cache": "1",
++    # "no-sandbox": "1",
++    # "local": "1",
+ }
diff --git a/rules/sha/index.bzl b/rules/sha/index.bzl
index 325e8e38220..ed2098d638a 100644
--- a/rules/sha/index.bzl
+++ b/rules/sha/index.bzl
@@ -12,6 +12,5 @@ def sha(name, srcs, **kwargs):
         }
         find $(SRCS) -type f | sort | xargs shasum | normalize_config_paths | shasum | awk '{ print $$1 }' > $@
         """,
-        local = 1,
         **kwargs
     )
diff --git a/rules/typescript/index.bzl b/rules/typescript/index.bzl
index 18352b132a6..ead7bb82b3d 100644
--- a/rules/typescript/index.bzl
+++ b/rules/typescript/index.bzl
@@ -64,7 +64,6 @@ def ts_jasmine_node_test(name, srcs, deps = [], size = "small", **kwargs):
         srcs = [":%s_commonjs.js" % name],
         outs = [":%s_commonjs.test.js" % name],
         cmd_bash = "cp $(SRCS) $@",
-        tags = ["local"],
     )
 
     jasmine_node_test(